Executive brief
A vulnerability was identified in the Linux kernel's Netfilter component, which is responsible for network traffic filtering and firewalling. Under certain conditions, processing specific network packets could cause the system to crash due to an improper memory reference. This could lead to a denial-of-service, impacting the availability of the affected system.
Technical details
A potential NULL pointer dereference exists in the nf_osf_ttl() function within net/netfilter/nfnetlink_osf.c. The function accessed the skb->dev pointer to perform local interface address lookups without verifying if the pointer was valid. Additionally, the logic incorrectly assumed subnet-local packets would not have decremented TTLs, which is often untrue in containerized or virtualized environments. An attacker can exploit this by sending crafted packets that trigger the vulnerable code path when OS fingerprinting is active. The fix removes the device dereference and replaces the complex interface lookup with a simplified switch statement for TTL evaluation.
Affected products
- Linux Linux Kernel 2.6.31 to 6.9.x
Timeline
- 2026-04-17: patched: Initial patch authored by Fernando Fernandez Mancera
- 2026-06-24: disclosed: CVE published to the NVD dataset
References
- https://git.kernel.org/stable/c/5d05de2f0928d81309a815ecc76d1a3ad72cbc16
- https://git.kernel.org/stable/c/711987ba281fd806322a7cd244e98e2a81903114
- https://git.kernel.org/stable/c/79b90a96688e521771fa6ed3dc7864b76b8df293
- https://git.kernel.org/stable/c/83fc5dd63455a779ea2dd0f7ffee3c920919d80b
- https://git.kernel.org/stable/c/95be653a76793856ff8b2d8bd82c2943c23f5ca8
- https://git.kernel.org/stable/c/c996a90f3071cf43683e5423da31aadbe002b8b4
- https://git.kernel.org/stable/c/edc806f9122961f0d3819f7c69c14cccde31f277